iptables

1.iptables -L

2.iptables -F   service iptables save or /etc/rc.d/init.d/iptables save 

3.iptables -A INPUT -p tcp --dport 22 -j ACCEPT (先保证ssh)

4.iptables -P INPUT DROP

5.iptables -P OUTPUT ACCEPT

6.iptables -P FORWARD DROP

7.添加需要的协议和端口:

eg1:   iptables -A INPUT -p icmp -j ACCEPT

eg2:   iptables-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT                 iptables-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

eg3: iptables -A INPUT -s 192.168.0.104 -p tcp --dport 22 -j ACCEPT    iptables -D INPUT -p tcp --dport 22 -j ACCEPT

 

格式:iptables [-t table] COMMAND chain CRETIRIA -j ACTION
 -t table :3个filter nat mangle
 COMMAND:定义如何对规则进行管理
 chain:指定你接下来的规则到底是在哪个链上操作的,当定义策略的时候,是可以省略的
 CRETIRIA:指定匹配标准
 -j ACTION :指定如何进行处理
 
转发:

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source 172.16.1.1

echo 1 > /proc/sys/net/ipv4/ip_forward  永久:vi /etc/sysctl.conf  修改: net.ipv4.ip_forward = 1 然后 sysctl -p /etc/sysctl.conf (需求内核中开启转发)

系统默认全放的基础上稍作更改放通 22 80 3306:

# Generated by iptables-save v1.4.7 on Fri May 26 22:53:53 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [58:7704]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri May 26 22:53:53 2017

 

 

 

posted @ 2017-03-14 09:55  feral  阅读(197)  评论(0编辑  收藏  举报